Skip to content

GHSA-g3cq-j2xw-wf74 on CTRL-OS 26.05

Aliases: GHSA-g3cq-j2xw-wf74, CVE-2026-54278

Packages: python3Packages.aiohttp

Status: Plausible

Advisory Information

Summary

During cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.

Impact

An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).

Workaround

Disable compression if unable to upgrade.

Patch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232

Updates

2026-07-10 22:13 CEST

Metadata changes:

  • Status for package python3Packages.aiohttp: “Plausible”

(Amended on: 2026-07-10 22:14 CEST)

2026-07-10 20:35 CEST

Metadata changes:

  • Status for package python3Packages.aiohttp: “New”